Client-side URL rewriter

Abstract

A system and method for client-side url rewriting. In one embodiment the method comprises a client sending a request for content to a client proxy, wherein the request for content comprises a first url. The client proxy may then rewrite the first url and redirect the request for content to a reverse proxy server. In such an embodiment, the request for content may be sent to the client proxy based on a proxy configuration of the client. In a further aspect of the method above, rewriting the first url with the client-side url rewriter may comprise rewriting the request for content to a second url, and including an indication of the first url in the rewritten request for content. Furthermore, the first url may correspond to an intranet server, while the second url may correspond to the reverse proxy server.

Description

BACKGROUND OF THE INVENTION

1. Field of the Invention

This invention relates to the field of computer systems and, more particularly, to URL rewriting.

2. Description of the Related Art

As web-based applications become more important to business and industry, system failure becomes more expensive, and highly reliable systems assume a greater importance. For example, a web site may handle financial, production, sales, marketing or media applications. Failure to provide these applications to clients for even a few minutes could mean thousands or millions of dollars in lost income.

One key strategy used to protect web infrastructure from external attacks is the isolation of an organization's internal servers through the use of reverse proxies and firewalls. More particularly, the internal servers of an organization may be configured to only communicate via certain channels through a firewall to a reverse proxy computer. In turn, the reverse proxy may send and receive communications to the internal servers on behalf of one or more clients. Only the reverse proxy may be able to communicate directly with client systems via the Internet.

Accordingly, a reverse proxy may receive a request for a web page from a client system, relay the request to an internal server through the firewall, receive the web page back from the internal server, and return the web page to the client. To allow client systems from to access content or services from the internal server without directly exposing the internal server on a public network, the reverse proxy may rewrite the Universal Resource Locators (URLs) of the returned web page to point to a reverse proxy for the internal server instead of pointing to the internal server itself. For example, the reverse proxy may rewrite each URL that points to the internal server on a returned web page by rewriting the URL to point to the reverse proxy, and by including an indication of the URL of the intranet server in the rewritten URLs. Accordingly, the client system which receives the web page may access only the reverse proxy through the returned URLs.

However, configuring the reverse proxy at the server-side to rewrite every internal server URL sent to a client may be difficult and time-consuming. Furthermore, server-side URL rewriting may consume significant computational resources.

SUMMARY

A system and method for client-side URL rewriting is disclosed. In one embodiment the method comprises a client sending a request for content to a client-side URL rewriter, wherein the request for content may specify a first URL. The client-side URL rewriter may then rewrite the first URL and redirect the request for content to a reverse proxy server. In such an embodiment, the first URL may correspond to an intranet server, and the client may be configured so that all requests for content having a URL corresponding to the intranet server are sent to a client proxy comprising the client-side URL rewriter. The request for content may be sent to the client proxy based on a proxy auto-configuration (PAC) of a browser application on the client.

In a further aspect of the method above, rewriting the first URL with the client-side URL rewriter may comprise rewriting the first URL as a second URL and including an indication of the first URL. The first URL may correspond to an intranet server, and the second URL may correspond to the reverse proxy server.

In yet another aspect of the method above, the method may further comprise the reverse proxy server retrieving content from an intranet server in accordance with the request for content, and the reverse proxy server returning said content to the client. In still another aspect of the method above, redirecting the request for content to a reverse proxy server may comprise a client proxy comprising the client-side URL rewriter returning the rewritten first URL to a browser, and the client proxy sending a redirect command to the browser to redirect the request according to the rewritten URL.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of one embodiment of a reverse proxy and intranet system with a client-side URL rewriter.

FIG. 2 is a flowchart illustrating one embodiment of a method for client-side rewriting of request URLs.

FIG. 3 is a block diagram of another embodiment of a reverse proxy and intranet system with a client proxy for client-side URL rewriting.

FIG. 4 is a block diagram of one embodiment of a computer system.

While the invention is susceptible to various modifications and alternative forms, specific embodiments are shown by way of example in the drawings and are herein described in detail. It should be understood, however, that drawings and detailed description thereto are not intended to limit the invention to the particular form disclosed, but on the contrary, the invention is to cover all modifications, equivalents and alternatives falling within the spirit and scope of the present invention as defined by the appended claims.

DETAILED DESCRIPTION OF EMBODIMENTS

Turning now to FIG. 1, an exemplary configuration of a client system 100, reverse proxies 120, and intranet servers 140 is shown. Client system 100 may be a laptop, desktop, server, workstation, palmtop, or other type of computer system. In one embodiment, client system 100 may include a browser 110 and a client-side URL rewriter 112, and may be directly connected to the Internet 150, or may be connected to the Internet 150 via a local area network (LAN) or wide area network (WAN) connection.

Each reverse proxy 120A-B may be a server or other type of computer system connected to the Internet 150 and intranet servers 140A-C via firewalls 130A-B. Intranet servers 140A-C may contain content, such as, for example, web pages or media files. Firewalls 130A-B may be operable to allow only authorized computer systems to communicate with intranet servers 140A-C. For example, in one embodiment, a firewall 130A-B may be operable to block all communications to intranet servers 140A-C which do not originate from reverse proxies 120A-B.

Each reverse proxy 120A-B may be operable to receive requests for content from other computer systems via the Internet 150. Each reverse proxy 120A-B may then be operable to relay a request for content to an intranet server 140A-C through a firewall 130A-B, and to receive content returned in response to the request from intranet servers 140A-C. Reverse proxies 120A-B may then be able to relay the returned content to the computer system which originated the request. It is noted that, in accordance with the above description, reverse proxy 120 A-B may be able to access content on intranet servers 140A-C on behalf of client system 100 without directly exposing intranet servers 140A-C to external connections, thereby providing intranet servers 140A-C with a greater degree of security from external attacks.

In one embodiment, client-side URL rewriter 112 may be a program configured as a client proxy for requests directed towards one or more intranet servers 140A-C. Client-side URL rewriter 112 may further be configured to rewrite the URLs of one or more content requests to redirect browser 110 to reverse proxies 120A-B rather than intranet servers 140A-C.

It is further noted that in various embodiments, additional firewalls 130 may be used in addition to or in place of firewalls 130A-B. For example, in one embodiment firewalls 130A-B may be positioned between Internet 150 and reverse proxy 120A-B. Likewise, in one embodiment a firewall 130 may be placed between client system 100 and Internet 150. In still further embodiments, no firewalls may be used.

Turning now to FIG. 2, a flow diagram of a method for rewriting request URLs with a client-side URL rewriter is shown. In 200, browser 110 sends a request for content on an intranet server 140A-C to client-side URL rewriter 112. For example, in one embodiment browser 110 may send a request to intranet server 140A with the URL “h t t p : / / i n t r a n e t . s u n . c o m / l o g i n . h t m l”. (Please note that spaces have been added to the example URL to prevent automatic hyperlink creation in online copies of this text.)

It is noted that, in one embodiment, browser 110 may be configured to route all requests for a particular URL to client-side URL rewriter 112. In one embodiment, browser 110 may utilize proxy settings, such as a Proxy Auto-Configuration (PAC), to determine a client proxy for a specific URL domain. The client proxy may include the client-side URL rewriter 112.

In 202, client-side URL rewriter 112 may rewrite the URL of the content request. More particularly, in one embodiment client-side URL rewriter 112 may rewrite the content request URL to point to a reverse proxy 120A-B and include an indication or encoding of the URL for an intranet server 140A-C. In one embodiment client-side URL rewriter 112 may rewrite the content request URL by prepending the URL of a reverse proxy 120A-B to the URL of the original request. For example, the URL “h t t p : / / i i n t r a n e t . s u n . c o m / l o g i n . h t m l” may become“h t t p : / / w w w . s u n . c o m / h t t p : / / i n t r a n e t . s u n . c o m / l o g i n . h t m l”.

Alternatively, in other embodiments client-side URL rewriter 112 may rewrite the content request URL to point to the URL of reverse proxy 120A-B, and also include a mapping of the URL of intranet server 140A-C. For example, the URL “h t t p: / / i n t r a n e t . s u n . c o m / l o g i n . h t m l” may become “h t t p : / / w w w . s u n . c o m / h o s t 1 / l o g i n . h t m l”, wherein “h o s t 1” is mapped to “h t t p : / / i n t r a n e t . s u n . c o m” at the reverse proxy. In still further embodiments, client-side URL rewriter 112 may rewrite the content request URL to point to the URL of reverse proxy 120A-B, and further utilize encryption or other mechanisms to include an indication of the URL of intranet server 140A-C in the rewritten content request URL. For example, the URL “h t t p : / / i n t r a n e t . s u n . c o m / l o g i n . h t m l” may become “h t t p : / / w w w . s u n . c o m / ? F e t c h = j o q d a p e d h . . . h e t z k w q”, wherein “j o q d a p e d h . . . h e t z k w q” is an encrypted or encoded string which decodes as “h t t p : / / i n t r a n e t . s u n . c o m / l o g i n . h t m l”.

In 204, client-side URL rewriter 112 may then return the rewritten request URL to browser 110. In one embodiment, the rewritten URL may be sent back to the browser with a redirect response code. A redirect response sent along with the URL code may cause a browser to send a new request for the URL. For example, as described above, client-side URL rewriter 112 may redirect a request to reverse proxy 120A-B.

In 206, browser 110 may send a request to reverse proxy 120A-B, as indicated by the rewritten URL and response code. For example, if browser 110 receives the URL “h t t p : / / w w w . s u n . c o m / h t t p : / / i n t r a n e t . s u n . c o m / l o g i n . h t m l” along with a redirect response code from client-side URL rewriter 112, browser 110 may then send a request for the rewritten URL to reverse proxy 120A-B, where “sun.com” is the URL for the reverse proxy. It is noted that, in one embodiment, browser 112 may only be configured to send requests for intranet servers 140 to client-side URL rewriter 112 (or to a client proxy including rewriter 112). Requests sent to other servers, such as reverse proxy servers 120A-B, may be sent directly to the requested server or through a different proxy. Accordingly, the redirected request may be sent directly to reverse proxy server 120A-B, thereby avoiding an infinite loop of return and redirect.

In 208, reverse proxy 120A-B retrieves the requested content from the appropriate intranet server 140A-C. More particularly, reverse proxy 120A-B may strip the prepended URL from the request sent by browser 110, leaving only the URL of the content on intranet server 140A-C. Reverse proxy 120A-B may then be operable to retrieve content from intranet server 140A-C through firewall 130A-B, as described above. In 110, reverse proxy 120A-B returns the retrieved content to browser 110. In one embodiment, the method may return to 100 if and when browser 110 requests additional content from intranet servers 140A-C.

It is noted that, in accordance with the above description, URLs directed towards intranet servers 140A-C may be rewritten by client-side URL rewriter 112, rather than by server-side reverse proxies 120A-B. Accordingly, the intranet servers 140A-C may be protected without placing URL rewriting workloads on reverse proxies 120A-B. Furthermore, in some embodiments client-side URL rewriter 112 may be able to more efficiently rewrite client-side URLs by accessing local state information from browser 112, such as scripting variables.

Turning now to FIG. 3, another exemplary configuration of a client system 100, reverse proxies 120, and intranet servers 140 is shown. Specifically, FIG. 3 illustrates one embodiment wherein client-side URL rewriter 112 executes on a client proxy 300. Client proxy 300 may be a computer system operable to receive requests from one or more client systems 100 and forward them to servers via the Internet 150. In other embodiments, client proxy 300 may be a process executing on the same computer as browser 110. In one embodiment, a firewall 130 may exist between client system 100 and client proxy 300, between client proxy 300 and Internet 150, or both. Client proxy 300 may also be configured to include client-side URL rewriter 112 to rewrite requests from browser 110, as described in FIG. 2 above.

In one embodiment, client proxy 300 may have client-side URL rewriter 112 already installed by a system administrator. Alternatively, in another embodiment client-side URL rewriter 112 may be a Java applet or Active X component, for example, downloaded from reverse proxy 120A-B. More particularly, reverse proxy 120A-B may be configured to return client-side URL rewriter 112 in response to an initial request for content, such as a request for an index page. Client-side URL rewriter 112 may then be operable to act as a client proxy for requests directed to intranet servers 140A-C, as described above in FIG. 2.

It is further noted that, in one embodiment, the functionality of client-side URL rewriter 112 may be integrated or hooked into browser 110. In such an embodiment, browser 110 (or a component hooked into browser 110) may be configured to detect any URL request directed towards an intranet server 140A-C, and to automatically rewrite the content request URL as described above. Furthermore, in such an embodiment browser 110 may not utilize a redirect response code, and may instead send the rewritten URL directly to reverse proxy 120A-B. In one embodiment, the client-side URL rewriter functionality may be part of a plug-in for browser 110, while in another embodiment browser 110 may be rewritten and recompiled with the additional functionality.

Turning now to FIG. 4, a hardware overview of exemplary computer system 400 is shown. Computer system 400 includes main memory 410, which is coupled to multiple processors 420A-B, and I/O interface 430. It is noted that the number of processors is purely illustrative, and that one or more processors may be resident on the node. I/O interface 430 further connects to network interface 440, hard disk drive 450, removable storage adapter 460, and display adapter 470. Such a system is exemplary of a laptop, desktop, server, or workstation. Processors 420A-B may be representative of any of various types of processors such as an x86 processor, a PowerPC processor or a CPU from the SPARC family of RISC processors. Likewise, main memory 410 may be representative of any of various types of memory, including DRAM, SRAM, EDO RAM, DDR SDRAM, Rambus RAM, etc., or a non-volatile memory such as a magnetic media, e.g., a hard drive, or optical storage. It is noted that in other embodiments, main memory 410 may include other types of suitable memory as well, or combinations of the memories mentioned above.

As described in detail above in conjunction with FIGS. 1-3, processors 420A-B of computer system 400 may execute software configured to perform the functions of client-side URL rewriter 112. The software may be stored in memory 410 of computer subsystem 400 in the form of instructions and/or data that implement the operations described above. Alternatively or additionally, computer system 400 may be operable to execute browser 110, reverse proxy server 120A-B, firewall 130A-B, intranet server 140A-C, or client proxy 300.

It is further noted that any of the embodiments described above may further include receiving, sending or storing instructions and/or data that implement the operations described above in conjunction with FIGS. 1-3 upon a computer accessible medium. Generally speaking, a computer accessible medium may include storage media or memory media such as magnetic or optical media, e.g. disk or CD-ROM, volatile or non-volatile media such as RAM (e.g. SDRAM, DDR SDRAM, RDRAM, SRAM, etc.), ROM, etc. as well as transmission media or signals such as electrical, electromagnetic, or digital signals conveyed via a communication medium such as network and/or a wireless link.

Although the embodiments above have been described in considerable detail, numerous variations and modifications will become apparent to those skilled in the art once the above disclosure is fully appreciated. It is intended that the following claims be interpreted to embrace all such variations and modifications.

Claims

1. A method, comprising:

a client sending an initial request for content to a reverse proxy connected to one or more intranet servers configured to serve the content;

in response to sending the initial request, receiving from the reverse proxy, data usable to implement a client-side url rewriter, wherein the url rewriter is operable to act as a client proxy for requests directed to any of the one or more intranet servers;

the client sending a request for content to the client-side url rewriter, wherein the request for content comprises a url identifying one of the intranet servers;

the client-side url rewriter rewriting the url, wherein the rewritten url identifies the reverse proxy;

the client-side url rewriter sending a redirect response code with the rewritten url back to the same client that sent the request to the client-side url rewriter; and

in response to receiving the rewritten url and redirect response code, the same client redirecting the request for content to the reverse proxy indicated by the rewritten url, wherein the redirected request is not sent to the url rewriter.

2. The method of claim 1, wherein the client is configured so that all requests for content having a url corresponding to the intranet server are sent to a client proxy comprising the client-side url rewriter.

3. The method of claim 2, wherein the request for content is sent to the client proxy based on a proxy auto-configuration (PAC) of a browser application on the client.

4. The method of claim 1 further comprising, in response to receiving the data usable to implement the client-side url rewriter, installing the client-side url rewriter on a computer separate from the client.

5. The method of claim 1, wherein the rewritten url includes an indication of the url.

6. The method of claim 1, wherein the client-side url rewriter is responsive to requests from the client and from one or more other clients over a client-side network.

7. The method of claim 1, wherein the method further comprises:

the reverse proxy server retrieving content from an intranet server in accordance with the request for content; and

the reverse proxy server returning said content to the client.

8. The method of claim 1, wherein redirecting the request for content to a reverse proxy server comprises:

a client proxy comprising the client-side url rewriter returning the rewritten url to a browser; and

the client proxy sending a redirect command to the browser.

9. A computer system, comprising:

a processor;

memory coupled to the processor and storing program instructions executable by the processor to implement:

a client sending an initial request for content to a reverse proxy connected to one or more intranet servers configured to serve the content;

in response to sending the request, receiving from the reverse proxy, data usable to implement a client-side url rewriter, wherein the url rewriter is operable to act as a client proxy for requests directed to any of the one or more intranet servers;

the client sending a request for content to the client-side url rewriter, wherein the request for content comprises a url identifying one of the intranet servers;

the client-side url rewriter rewriting the url, wherein the rewritten url identifies the reverse proxy;

the client-side url rewriter sending a redirect response code with the rewritten url back to the same client that sent the request to the client-side url rewriter; and

in response to receiving the rewritten url and redirect response code, the same client redirecting the request for content to the reverse proxy indicated by the rewritten url, wherein the redirected request is not sent to the url rewriter.

10. The system of claim 9, wherein the client is configured to send all requests for content having urls corresponding to the intranet server to a client proxy comprising the client-side url rewriter.

11. The system of claim 10, further comprising a proxy auto-configuration (PAC) file configured to indicate that the request for content should be sent to the client proxy from a browser application on the client.

12. The system of claim 9, wherein the client-side url rewriter is installed on a computer separate from the client.

13. The system of claim 9, wherein the rewritten url includes an indication of the url.

14. The system of claim 9, wherein the client-side url rewriter is responsive to requests from the client and from one or more other clients over a client-side network.

15. The system of claim 9, wherein the reverse proxy server is further configured to:

retrieve the content identified by the request for content, from the intranet server; and

return the identified content to the client.

16. The system of claim 9, wherein the client-side url rewriter is operable to redirect the request for content to a reverse proxy server by:

returning the rewritten first url to a browser; and

sending a redirect command to the browser.

17. A non-transitory computer accessible storage medium storing program instructions computer executable to implement a method comprising:

a client sending an initial request for content to a reverse proxy connected to one or more intranet servers configured to serve the content;

in response to sending the initial request, receiving from the reverse proxy, data usable to implement a client-side url rewriter, wherein the url rewriter is operable to act as a client proxy for requests directed to any of the one or more intranet servers;

the client sending a request for content to the client-side url rewriter, wherein the request for content comprises a url identifying one of the intranet servers;

the client-side url rewriter rewriting the url, wherein the rewritten url identifies the reverse proxy server;

the client-side url rewriter sending a redirect response code with the rewritten url back to the same client that sent the request to the client-side url rewriter; and

in response to receiving the rewritten url and redirect response code, the same client redirecting the request for content to the reverse proxy indicated by the rewritten url, wherein the redirected request is not sent to the url rewriter.

18. The computer accessible medium of claim 17, wherein the client is configured so that requests for content comprising urls corresponding to the intranet server are sent to a client proxy comprising the client-side url rewriter.

19. The computer accessible medium of claim 18, wherein the request for content is sent to the client proxy based on a proxy auto-configuration (PAC) of a browser application on the client.

20. The computer accessible medium of claim 17, wherein the client-side url rewriter is installed on a computer separate from the client.

21. The computer accessible medium of claim 17, wherein the rewritten url includes an indication of the url.

22. The computer accessible medium of claim 21, wherein the client-side url rewriter is responsive to requests from the client and from one or more other clients over a client-side network.

23. The computer accessible medium of claim 17, wherein redirecting the request for content to a reverse proxy server comprises:

the client-side url rewriter returning the rewritten first url to a browser; and

the client-side url rewriter sending a redirect command to the browser.